SECAI Core · phase 12 of 15 · noun
Dynamic application security testing
Testing that is done after code is placed into production and is able to unearth vulnerabilities that are evident once the code is in production.
The Explain card
- Plain English
- DAST tests a running application from the outside, probing it the way an attacker would, to uncover vulnerabilities that only appear once the code is deployed and live.
- Example
- A DAST tool fires crafted requests at a deployed chatbot API and discovers that error responses reveal the system prompt and internal hostnames.
- Why it matters
- Some flaws exist only in configuration, integration, or runtime behavior that static review cannot see. For AI endpoints, DAST-style probing is how you learn what the model actually leaks under pressure.
- Hook
- Kicking the tires on the car that is already on the road.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The security team ran dynamic application security testing against the deployed API and recorded the SQL injection responses returned by its authentication endpoint.
Why these words
- dynamic Greek dynamikos, powerful, through French dynamique marks the runtime-oriented mode of examination
- application Latin applicare, to attach or join names the software target
- security Latin securitas, freedom from care or danger specifies the protective domain being evaluated
- testing Old French test, an assay vessel serves as the head noun for systematic examination
Where it came from
- Origin
- an English computing compound formed from dynamic, application security, and testing
- Entered the language
- 2000s
- What changed
- Dynamic moved from physical force to changing or runtime conditions, application acquired its software sense, security became a computing field, and testing broadened from physical assay to technical evaluation.
How it is spelled
- Pattern
- The four words form an open compound with spaces and no hyphens.
- Pattern
- Dynamic keeps the Greek-derived ending -ic.
- Pattern
- Application keeps the noun-forming ending -ation, security keeps -ity, and testing keeps -ing.
Spelled like
- static application security testing
- interactive application security testing
- mobile application security testing
Broken into chunks
-
dynam
- dynamics
- dynamism
- dynamo
-
applic
- applicable
- applicant
- apply
-
secur
- secure
- securing
- securely
-
test
- tester
- retest
- testable
What it sits beside
Same subject
- static application security testing
- interactive application security testing
- penetration testing
- vulnerability scanning
Same shape
- static application security testing
- interactive application security testing
- mobile application security testing
application security testing methods
- dynamic application security testing
- static application security testing
- interactive application security testing
security testing activities
- penetration testing
- fuzz testing
- vulnerability scanning
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defenses directly to the attacks just cataloged — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
